Everyone is watching the Digital Omnibus and asking the same thing: will the cookie banner finally die? Wrong question. The provision that will actually move your charts has nothing to do with the banner. It is the ban on re-asking for consent for six months after a refusal, purpose by purpose. In plain terms, a visitor who clicks “Reject” today goes invisible to your measurement until next spring, and you no longer get to try your luck on their next session. This is not one more legal note. It is a measurement practitioner’s impact analysis: how far your observed consent rate is about to drop, what that does to your GA4 volume and modeling, and above all what you configure right now to cushion the blow.
Last updated: August 24, 2026. The text is not yet adopted; every point is dated and tied to a stage of the procedure.
The 60-second summary
Before the detail, here is where things stand as of August 24, 2026. The Digital Omnibus pulls cookie rules out of the ePrivacy Directive and writes them into the GDPR through a new Article 88a. The table below separates what changes from what does not.
| Topic | Before (ePrivacy) | With the Digital Omnibus (Article 88a) |
|---|---|---|
| Legal basis for cookies | ePrivacy Directive, transposed country by country | GDPR regulation, applied uniformly across the EU |
| Refusing consent | Freely re-asked, often every session | Cannot re-ask the same purpose for 6 months |
| ”Reject” button | Often buried on a second screen | One-click reject, as prominent as “Accept” |
| Audience measurement | Grey area depending on national authority | Narrow, strict exemption; standard GA4 out of scope |
| Supervisory authority | National ePrivacy authorities | GDPR authorities, GDPR fine ceilings |
| Browser signal (88b) | Nonexistent | Removed by the Council on June 18, 2026 |
The takeaway: the banner does not disappear, refusal becomes far more expensive for your data, and the technological rescue you were promised (the browser signal) just got cut from the final edit. Let’s unpack it.
Why ePrivacy is dead, and why it concerns you
On February 11, 2025, the Commission withdrew the draft ePrivacy Regulation from its work programme, after eight years stuck in the Council. That text was meant to replace a 2002 directive that had become absurd in the age of modern tracking. It will never arrive. The gap is filled by the Digital Omnibus, proposed on November 19, 2025, which migrates terminal-access rules (cookies, local storage, fingerprinting) directly into the GDPR.
Why it concerns you, the person running tracking rather than litigation: because changing the legal vehicle changes the authority, the penalties, and above all the mechanics of consent. This is no longer about the formal compliance of your banner; it is a rule that decides how many of your visitors you are still allowed to measure. It is a data problem before it is a legal one. And it stacks onto an already tense backdrop: the Privacy Sandbox is dead, signal is thinning everywhere, and the drop in observed conversions is well documented. For the full picture of that signal scarcity, I laid it out in The Privacy Sandbox is dead: what it means for your tracking in 2026.
Article 88a: the 4 exceptions, and why GA4 is not one of them
Article 88a keeps the principle intact: no terminal access without consent, save for narrow exceptions. In the proposal, those exceptions cover roughly four cases: transmitting a communication, a service explicitly requested by the user, security and fraud prevention, and aggregate audience measurement carried out by the publisher for its own account.
It is the fourth that gets everyone dreaming: “so GA4 slides into the audience-measurement exemption?” No. The audience-measurement exception, as framed, assumes a single-service scope, use strictly internal to the publisher, and no sharing with a third party. Standard GA4 sends data to Google, which processes it for its own account and uses it beyond the single site. You fall out of scope on the very first request. Standard GA4 is therefore not exempt, full stop.
Then comes the reflex question: “what if I go server-side, does that pull me out of consent?” Honest answer: no, not on its own. Server-side changes who receives the data and how it travels; it does not change the purpose or the final recipient. If your server container still relays to Google Analytics and Google Ads, you remain in an advertising and measurement purpose subject to consent. Server-side is an excellent lever for robustness and signal quality; it is not a machine that manufactures exemptions. To understand what it actually moves, see GTM Server-Side: why and how to migrate in 2026.
The Digital Omnibus 6-month rule: the real operational shock
Here is the heart of it, the part nobody quantifies. Article 88a provides that after a refusal, the controller may not re-ask for consent for the same purpose for at least six months. A click on “Reject” can no longer be recovered on the next visit. Today, a huge share of consent is won through repetition: the user closes the banner the first time, accepts on the second or third. That mechanism disappears.
Take two identical sites, 100,000 unique visitors a month, a “cold” acceptance rate of 55% on the very first display. Site A re-prompts every session until the user decides, and picks up consent over successive visits. Site B, brought into 88a compliance, respects the six-month cooldown on any refusal.
| Metric (over 12 months) | Site A (re-prompt every session) | Site B (6-month cooldown) |
|---|---|---|
| Acceptance on first display | 55% | 55% |
| Explicit refusals locked for 6 months | negligible | ~30% of the base |
| Stabilized observed consent rate | ~70 to 75% | ~55% |
| Measured sessions vs today | baseline | -15 to -25 points |
The figures are illustrative, not a promise: your real delta depends on your returning traffic, your share of new visitors, and the quality of your banner. But the direction is certain. The more loyal your audience and the more often it returns, the more “recoverable” refusals you used to reclaim, and the sharper the fall. A media site with 60% returning traffic takes a harder hit than a pure cold-acquisition site. The 6-month rule turns a temporary, porous refusal into a durable, watertight one.
What it does to your data
Once the consent rate is structurally lower, the effect ripples through the whole chain. GA4 collected volume falls, mechanically. The share of modeled sessions, the ones GA4 reconstructs statistically for users without consent, rises: you are steering on a growing proportion of estimates rather than observations. And modeling needs a large enough base of consented data to run properly; below a certain threshold it degrades or stops triggering altogether.
The most sensitive link is Consent Mode. In advanced mode, tags load and send anonymous cookieless pings even without consent, which feeds Google’s modeling. In basic mode, nothing leaves until consent is granted, and you lose all the raw material to model with. With the 6-month rule inflating the population of locked refusals, the difference between advanced and basic is no longer a config detail: it is what decides whether Google has anything to reconstruct your conversions from. If this is not airtight on your side, start here: Consent Mode v2 in GA4: what changes and how to stop losing conversions.
At the end of the chain, Google Ads conversion modeling loses signal, attribution gets blurrier, and your totals reconcile even less. This effect stacks onto the drop already underway on the attribution side, which I detailed in GA4 Attribution 2026: what changed. The defensive reflex is to go find signal where it is still reliable, server-side, with properly wired server-side Enhanced Conversions: it does not replace lost consent, but it recovers match quality on the consented share.
Article 88b: the plot twist nobody has absorbed
Here is the reversal the online coverage has not digested. Article 88a’s counterpart, Article 88b, provided for a consent signal at the browser or operating-system level: the user sets a preference once, sites respect it, and banners become unnecessary. It was supposed to be the good news in the text. Except that in its position of June 18, 2026, the Council removed Article 88b outright. Germany, France, and Poland were among the states in favor of the removal, after heavy lobbying from the advertising industry.
Operational translation: the browser signal that was meant to save the banners is off the menu, while the 6-month rule stays. That is the exact opposite of what a good chunk of published content still says, including recent pieces that present 88b as a done deal. One caveat, though: Parliament has not yet set its position, and Parliament is the one that could reintroduce 88b in trilogue. Two concrete consequences. First, the banners stay, and GPC (Global Privacy Control) does not become mandatory in the EU for now. Second, do not scrap the “signal-ready” project either: if Parliament puts 88b back on the table, with an announced application window around 24 months, you will be glad to have a clean, centralized consent architecture ready to listen to an external signal.
Checklist: the 6 things to prepare now
The clock is short. Article 88a would apply six months after the text enters into force, itself expected late 2026 or early 2027. Here is what I would start building without waiting for the final vote.
- Log the refusal, timestamped and per purpose. You need to be able to prove the date of a refusal and know when the six-month cooldown expires, purpose by purpose. Without that log, you can neither respect the rule nor audit your own rate.
- Wire a per-purpose cooldown in the CMP. Configure your banner not to re-prompt a refused purpose before the deadline. Many CMPs today handle a global cooldown; you need to move to a granular, per-purpose cooldown.
- Switch Consent Mode to advanced and verify it down to the server container. This is the single move that saves the most modeled data. Check that the signal flows cleanly from the banner to the server-side, with no tag firing before consent.
- Audit the tags that fire before consent. With refusal now durable, any tag leaking upstream becomes a risk and a source of noise. A GA4 configuration audit lets you spot those premature triggers quickly.
- Prepare an exempt audience-measurement plan B, alongside GA4. An internal, single-service measurement solution with no third-party sharing can keep running on the refused share if it respects the exemption framework. It is not a GA4 replacement; it is a safety net so you are not flying completely blind.
- Govern your proof of exemption. Since January 1, 2026, the French CNIL has removed its public list of evaluated audience-measurement solutions: the burden of proving the exemption shifts to the publisher. Document your configuration, your purpose, and your lack of sharing, so you can defend it.
What I take away
The Digital Omnibus is not the end of the banner, it is the end of porous refusal. The six-month rule will lower your observed consent rate structurally, and that drop propagates all the way to your modeled conversions. The browser signal that was supposed to compensate has just been removed by the Council, even if Parliament can still bring it back. You are not a lawyer and neither am I: the subject here is not compliance, it is your curve. And on the curve, the best decision today is to log refusals cleanly, harden your advanced Consent Mode all the way to the server, and prepare an exempt measurement track in parallel. Do it before entry into force: those who wait for the final vote will discover the hole in their data once it has already been dug.